FX has reported a vulnerability in Cisco IOS, which can be exploited by malicious people to bypass certain security restrictions.

The vulnerability is caused due to an error within the handling of GRE packets with source routing information as the offset field is not verified before being used to decapsulate a packet. This can potentially be exploited to bypass access control lists on the router by sending specially crafted packets.

The vulnerability affects Cisco IOS 12.0, 12.1, and 12.2 based trains when configured with GRE IP or GRE IP multipoint tunnels.

NOTE: Cisco IOS version 12.0S, with a revision later than 12.0(23)S, with CEF enabled is not affected.

Solution
Apply patch CSCuk27655, CSCea22552, or CSCei62762.

Provided and/or discovered by
FX, Phenoelit.

Changelog
Further details available in Customer Area

Original Advisory
Phenoelit:
http://www.phenoelit.de/stuff/CiscoGRE.txt

Cisco:
http://www.cisco.com/warp/public/707/cisco-sr-20060906-gre.shtml

Deep Links
Links available in Customer Area